Method for realizing precomputation of Kyber packaging mechanism

Abstract

The invention relates to a Kyber encapsulation mechanism precomputation implementation method, and belongs to the technical field of encryption. The method comprises the following steps: directly pre-storing a public key polynomial matrix A when a deblocking key holder executes a key pair generation process, and pre-calculating and storing the polynomial matrix A by packaging a public key of the key holder; an encapsulation key holder executes an encapsulation process, and an unencapsulation key holder directly reads the public key polynomial matrix A when executing an unencapsulation process. According to the Kyber packaging mechanism pre-computation implementation method, the packaging and de-packaging speed can be greatly improved by about 30% at most. Under the condition that storage resources are sufficient and the efficiency requirement is high, the operation efficiency of the algorithm is effectively improved, and packaging and de-packaging tasks are normally completed.

Description

Technical Field

[0001] The present invention belongs to the field of encryption technology, and in particular relates to a Kyber encapsulation mechanism pre-calculation implementation method. Background Art

[0002] The overall process of the current Kyber packaging mechanism real-time computing implementation is as follows Figure 1 As shown in the figure, it is mainly divided into three parts: key pair generation algorithm, encapsulation algorithm, and decapsulation algorithm.

[0003] The decryption key holder (i.e., the key pair generator) executes the key pair generation algorithm. Step 1, generate a random number sequence d and a random number sequence z; Step 2, hash the random number d, generate a public key random seed ρ and a noise random seed σ; Step 3, use the public key random seed ρ to sample the public key polynomial matrix A = Sam (ρ); Step 4, use the noise random seed σ to sample the private key polynomial vector s and the noise polynomial vector e; Step 5, calculate the public key polynomial vector t = As + e; Step 6, encode the public key polynomial vector t and the public key random seed ρ, generate the encrypted public key pk, encode the private key polynomial vector s, and generate the decrypted private key sk; Step 7, calculate the encrypted public key hash value h (pk), and synthesize the decryption key dk = (sk, pk, h (pk), z). The encrypted public key pk is the encapsulation key ek, which is sent to the encapsulation key holder for storage, and the decryption key is stored by itself.

[0004] The holder of the encapsulation key executes the encapsulation algorithm. Step 1, generate a random number sequence m; Step 2, calculate the hash value H(pk) of the encrypted public key pk; Step 3, hash the random number m and the public key hash value H(pk) to generate the shared key K and the random coin r; Step 4, decode the encrypted public key pk, generate the public key polynomial vector t and the public key random seed ρ; Step 5, use the public key random seed ρ to sample the public key polynomial matrix A=Sam(ρ); Step 6, use the random coin r to sample the polynomial vector r, the noise polynomial vector e1 and the noise polynomial e2; Step 7, calculate the ciphertext polynomial vector u=A T r+e1, calculate the ciphertext polynomial v=t T r+e2+μ; Step 8, compress and encode the ciphertext polynomial vector u to generate the ciphertext c1, compress and encode the ciphertext polynomial v to generate the ciphertext c2, and synthesize the ciphertext c1 and the ciphertext c2 into the final ciphertext c; Step 9, output the shared key K, and send the ciphertext c to the holder of the decryption key.

[0005] After receiving the ciphertext, the decapsulation key holder executes the decapsulation algorithm. Step 1: split the ciphertext c into ciphertext c1 and ciphertext c2, decode ciphertext c1 to generate the ciphertext polynomial vector u, decode ciphertext c2 to generate the ciphertext polynomial v; Step 2: decode the decryption private key sk to generate the private key polynomial vector s; Step 3: calculate the decryption polynomial w = vs T u; Step 4, compress and encode the decryption polynomial w, and decrypt the random number sequence m'; Step 5, hash the random number m' and the public key hash value H(pk) to generate the shared key K' and the random coin r'; Step 6, decode the encrypted public key pk, and generate the public key polynomial vector t and the public key random seed ρ; Step 7, use the public key random seed ρ to sample the public key polynomial matrix A = Sam(ρ); Step 8, use the random coin r' to sample the polynomial vector r', the noise polynomial vector e1' and the noise polynomial e2'; Step 9, calculate the ciphertext polynomial vector u' = A T r'+e1', calculate the ciphertext polynomial v'=t T r'+e2'+μ; Step 10, compress and encode the ciphertext polynomial vector u', generate the ciphertext c1', compress and encode the ciphertext polynomial v', generate the ciphertext c2', and synthesize the ciphertext c1' and the ciphertext c2' into the final ciphertext c'; Step 11, verify whether the ciphertext c' is equal to the ciphertext c, if they are equal, no operation is performed, if they are not equal, perform key derivation (hash operation) on the ciphertext c and the random number z, and reassign the shared key K' as the derived value. Step 12, output the shared key K'.

[0006] The existing real-time computing implementation of the Kyber encapsulation mechanism is that steps 4-8 of the encapsulation algorithm and steps 6-10 of the decapsulation algorithm are public key encryption steps. The encrypted public key does not directly contain the polynomial matrix A, but contains the public key random seed ρ used to sample the polynomial matrix A. In each public key encryption process, it is necessary to first use the public key random seed ρ in the public key to resample the public key polynomial matrix A. The sampling process and results are exactly the same as the sampling process and results in the key pair generation algorithm. The sampling process uses rejection sampling for each coefficient of each polynomial in the polynomial matrix. The number of polynomial coefficients is large and the rejection probability is high. The entire sampling process takes a long time, and the number of samplings required for different public key random seeds is unstable. The purpose of this design is to reduce the size of public and private keys and reduce network transmission pressure, but it will increase the time for encapsulation and decapsulation. In some scenarios where storage resources are sufficient but efficiency requirements are high, this implementation is inefficient or even unusable. Summary of the invention

[0007] 1. Technical issues to be resolved

[0008] The technical problem to be solved by the present invention is how to provide a pre-calculation implementation method of the Kyber encapsulation mechanism to solve the problem that the existing real-time calculation implementation method of the Kyber encapsulation mechanism will increase the time for encapsulation and decapsulation.

[0009] (II) Technical solution

[0010] In order to solve the above technical problems, the present invention proposes a pre-calculation implementation method of the Kyber encapsulation mechanism, which includes:

[0011] When the unsealing key holder performs the key pair generation process, the public key polynomial matrix A is directly pre-stored, and the public key of the encapsulating key holder is pre-calculated and stored polynomial matrix A;

[0012] When the encapsulation key holder performs the encapsulation process and the decapsulation key holder performs the decapsulation process, the public key polynomial matrix A is directly read.

[0013] Furthermore, the process of generating a key pair by the unsealing key holder includes:

[0014] Step S11, generating a random number sequence d and a random number sequence z;

[0015] Step S12, hashing the random number d to generate a public key random seed ρ and a noise random seed σ, (ρ, σ) = G(d);

[0016] Step S13, using the public key random seed ρ to sample the public key polynomial matrix A=sam(ρ);

[0017] Step S14, using the noise random seed σ to sample the private key polynomial vector s and the noise polynomial vector e, (s, e) = Sam(σ);

[0018] Step S15, calculating the public key polynomial vector t=As+e;

[0019] Step S16, encode the public key polynomial vector t and the public key random seed ρ to generate the encryption public key pk=encode(t,ρ), encode the private key polynomial vector s to generate the decryption private key sk=encode(s);

[0020] Step S17, calculate the hash value h(pk) of the encrypted public key pk, and synthesize the decryption key dk=(sk,pk,h(pk),z); the encrypted public key pk is the encapsulation key ek, which is sent to the encapsulation key holder, the decryption key dk is stored by itself, and the public key polynomial matrix A is pre-stored at the same time.

[0021] Furthermore, the step S17 also includes: the encapsulation key holder receives the encapsulation key ek, stores the encapsulation key ek, and extracts the public key random seed ρ in the encapsulation key ek, and according to the sampling process of step S13, uses the public key random seed ρ to pre-sample the public key polynomial matrix A, and then pre-stores the public key polynomial matrix A.

[0022] Furthermore, the pre-storage method of the public key polynomial matrix A is non-volatile storage.

[0023] Furthermore, the step S13 specifically includes:

[0024] S131, first absorb the public key random seed ρ;

[0025] S132, then squeeze out a certain number of sample sequences B, which conform to uniform random distribution;

[0026] S133, then sample a polynomial coefficient, determine whether the polynomial coefficient meets the conditions, if so, retain the polynomial coefficient, if not, reject the polynomial coefficient, determine whether there are remaining samples in the sample sequence B, if yes, resample the coefficient, if no, squeeze a new sample sequence and resample the polynomial coefficient, and repeat until a polynomial coefficient that meets the conditions is sampled;

[0027] S134. Finally, determine whether there are any unsampled polynomial coefficients. If not, the sampling of the polynomial coefficients of the public key matrix is ​​completed. If so, determine whether there are remaining samples in the sample sequence B. If so, sample the next polynomial coefficient. If not, squeeze out a new sample sequence and then sample the next polynomial coefficient. Repeat this cycle until the sampling of all polynomial coefficients of the public key matrix A is completed.

[0028] Furthermore, in S131, the public key random seed ρ is absorbed by the SHAKE-128 algorithm.

[0029] Furthermore, in S132, S133, and S134, the SHAKE-128 algorithm is used to squeeze out the sample sequence.

[0030] Furthermore, the encapsulation key holder performs encapsulation including the following steps:

[0031] Step S21, generating a random number sequence m;

[0032] Step S22, hashing the encrypted public key pk to generate a public key hash value H(pk);

[0033] Step S23, hash the random number m and the public key hash value H(pk) to generate a shared key K and a random coin r, (K, r) = G(m, H(pk));

[0034] Step S24, decode the encrypted public key pk, generate the public key polynomial vector t and the public key random seed ρ, (t, ρ) = decode(pk);

[0035] Step S25, reading the pre-calculated and stored public key polynomial matrix A;

[0036] Step S26, using a random coin r to sample the polynomial vector r, the noise polynomial vector e1 and the noise polynomial e2, (r, e1, e2) = Sam (r);

[0037] Step S27, calculate the ciphertext polynomial vector u=A T r+e1, calculate the ciphertext polynomial v=t T r+e2+μ;

[0038] Step S28, compress and encode the ciphertext polynomial vector u to generate the ciphertext c1, compress and encode the ciphertext polynomial v to generate the ciphertext c2, and synthesize the ciphertext c1 and the ciphertext c2 into the final ciphertext c=(c1, c2);

[0039] Step S29: Output the shared key K and send the ciphertext c to the decryption key holder.

[0040] Furthermore, the decapsulation process performed by the decapsulation key holder includes: after receiving the ciphertext c, the decapsulation key holder performs the following steps:

[0041] Step S31, splitting the ciphertext c into ciphertext c1 and ciphertext c2, decoding the ciphertext c1 to generate a ciphertext polynomial vector u, decoding the ciphertext c2 to generate a ciphertext polynomial v;

[0042] Step S32, decoding the decryption private key sk, generating a private key polynomial vector s=decode(sk);

[0043] Step S33: Calculate the decryption polynomial w=vs T u;

[0044] Step S34, compress and encode the decryption polynomial w to decrypt the random number sequence m';

[0045] Step S35, hash the random seed m' and the public key hash value h(pk) to generate a shared key K' and a random coin r';

[0046] Step S36, decoding the encrypted public key pk, generating a public key polynomial vector t and a public key random seed ρ;

[0047] Step S37, reading the pre-stored public key polynomial matrix A;

[0048] Step S38, using random coin r' to sample polynomial vector r', noise polynomial vector e1' and noise polynomial e2', (r', e1', e2') = Sam(r');

[0049] Step S39, calculate the ciphertext polynomial vector u'=A T r'+e1', calculate the ciphertext polynomial v'=t T r'+e2'+μ;

[0050] Step S310, compress and encode the ciphertext polynomial vector u' to generate the ciphertext c1', compress and encode the ciphertext polynomial v' to generate the ciphertext c2', and synthesize the ciphertext c1' and the ciphertext c2' into the final ciphertext c';

[0051] Step S311, verify whether the ciphertext c' is equal to the ciphertext c, if they are equal, no operation is performed, if they are not equal, a key is derived from the ciphertext c and the random number z, and the shared key K' is reassigned to the derived value K'=KDF(z,c);

[0052] Step S312: finally output the shared key K'.

[0053] Furthermore, in S311, the key is derived using a hash operation.

[0054] (III) Beneficial effects

[0055] The present invention proposes a pre-calculation implementation method of the Kyber encapsulation mechanism. Compared with the existing real-time calculation implementation method of the Kyber encapsulation mechanism, the pre-calculation implementation method of the Kyber encapsulation mechanism of the present invention can greatly improve the encapsulation and decapsulation speed, which can be increased by about 30% at most. In the case of sufficient storage resources and high efficiency requirements, the operation efficiency of the algorithm is effectively improved, and the encapsulation and decapsulation tasks are completed normally. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is the overall flow chart of the real-time calculation implementation method of the Kyber packaging mechanism in the prior art;

[0057] Figure 2 This is a schematic diagram of the sampling process of the polynomial coefficients of the public key matrix A of the Kyber encapsulation mechanism of the present invention;

[0058] Figure 3 This is an overall flow chart of the Kyber encapsulation mechanism pre-computation implementation method of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0060] The present invention provides a pre-calculation implementation method for the Kyber encapsulation mechanism, the main purpose of which is to invent an implementation method that can significantly reduce the execution time of encapsulation and decapsulation. When storage resources are sufficient but efficiency requirements are high, the algorithm efficiency can be effectively improved and the key encapsulation and decapsulation tasks can be completed normally.

[0061] The overall process of the Kyber encapsulation mechanism pre-computation implementation method provided by the present invention is as follows: Figure 3 As shown, it mainly includes three parts: key pair generation algorithm, encapsulation algorithm and decapsulation algorithm.

[0062] The unsealing key holder (ie, the key pair generator) executes the key pair generation algorithm.

[0063] Step S11, generating a random number sequence d and a random number sequence z;

[0064] Step S12, hashing the random number d to generate a public key random seed ρ and a noise random seed σ, (ρ, σ) = G(d);

[0065] Step S13: Use the public key random seed ρ to sample the public key polynomial matrix A=sam(ρ).

[0066] The sampling process is as follows Figure 2 As shown,

[0067] S131. First, the public key random seed ρ is absorbed by the SHAKE-128 algorithm.

[0068] S132. Then the SHAKE-128 algorithm squeezes out a certain number of sample sequences B, which conform to the uniform random distribution.

[0069] S133. Then sample a polynomial coefficient and determine whether the polynomial coefficient meets the conditions. If so, keep the polynomial coefficient; if not, reject the polynomial coefficient and determine whether there are remaining samples in sample sequence B. If yes, resample the coefficient; if no, SHAKE-128 squeezes a new sample sequence and then resamples the polynomial coefficient. Repeat until a polynomial coefficient that meets the conditions is sampled.

[0070] S134. Finally, determine whether there are any unsampled polynomial coefficients. If not, the sampling of the polynomial coefficients of the public key matrix is ​​completed. If so, determine whether there are any remaining samples in the sample sequence B. If yes, sample the next polynomial coefficient. If not, SHAKE-128 squeezes a new sample sequence and then samples the next polynomial coefficient. Repeat until all the polynomial coefficients of the public key matrix A are sampled.

[0071] Step S14, using the noise random seed σ to sample the private key polynomial vector s and the noise polynomial vector e, (s, e) = Sam(σ);

[0072] Step S15, calculating the public key polynomial vector t=As+e;

[0073] Step S16, encode the public key polynomial vector t and the public key random seed ρ to generate the encryption public key pk=encode(t,ρ), encode the private key polynomial vector s to generate the decryption private key sk=encode(s);

[0074] Step S17, calculate the hash value h(pk) of the encrypted public key pk, and synthesize the decryption key dk = (sk, pk, h(pk), z); the encrypted public key pk is the encapsulation key ek, which is sent to the encapsulation key holder, and the decryption key dk is stored by itself, and the public key polynomial matrix A is pre-stored at the same time. The encapsulation key holder receives the encapsulation key ek, stores the encapsulation key ek, and extracts the public key random seed ρ in the encapsulation key ek, according to Figure 2 In the sampling process of step S13 shown, the public key random seed ρ is used to pre-sample the public key polynomial matrix A, and then the public key polynomial matrix A is pre-stored. The pre-storage method of the public key polynomial matrix A is non-volatile storage.

[0075] The wrapping key holder executes the wrapping algorithm.

[0076] Step S21, generating a random number sequence m;

[0077] Step S22, hashing the encrypted public key pk to generate a public key hash value H(pk);

[0078] Step S23: Hash the random number m and the public key hash value H(pk) to generate a shared key K and a random coin r, (K, r) = G(m, H(pk)).

[0079] Step S24, decode the encrypted public key pk, generate the public key polynomial vector t and the public key random seed ρ, (t, ρ) = decode(pk);

[0080] Step S25, reading the pre-calculated and stored public key polynomial matrix A;

[0081] Step S26, using a random coin r to sample the polynomial vector r, the noise polynomial vector e1 and the noise polynomial e2, (r, e1, e2) = Sam (r);

[0082] Step S27, calculate the ciphertext polynomial vector u=A T r+e1, calculate the ciphertext polynomial v=t T r+e2+μ;

[0083] Step S28, compress and encode the ciphertext polynomial vector u to generate the ciphertext c1, compress and encode the ciphertext polynomial v to generate the ciphertext c2, and synthesize the ciphertext c1 and the ciphertext c2 into the final ciphertext c=(c1, c2);

[0084] Step S29: Output the shared key K and send the ciphertext c to the decryption key holder.

[0085] After receiving the ciphertext c, the decapsulation key holder executes the decapsulation algorithm.

[0086] Step S31, splitting the ciphertext c into ciphertext c1 and ciphertext c2, decoding the ciphertext c1 to generate a ciphertext polynomial vector u, decoding the ciphertext c2 to generate a ciphertext polynomial v;

[0087] Step S32, decoding the decryption private key sk, generating a private key polynomial vector s=decode(sk);

[0088] Step S33: Calculate the decryption polynomial w=vs T u;

[0089] Step S34, compress and encode the decryption polynomial w to decrypt the random number sequence m';

[0090] Step S35, hash the random seed m' and the public key hash value h(pk) to generate a shared key K' and a random coin r';

[0091] Step S36, decoding the encrypted public key pk, generating a public key polynomial vector t and a public key random seed ρ;

[0092] Step S37, reading the pre-stored public key polynomial matrix A;

[0093] Step S38, using random coin r' to sample polynomial vector r', noise polynomial vector e1' and noise polynomial e2', (r', e1', e2') = Sam(r');

[0094] Step S39, calculate the ciphertext polynomial vector u'=A T r'+e1', calculate the ciphertext polynomial v'=t T r'+e2'+μ;

[0095] Step S310, compress and encode the ciphertext polynomial vector u' to generate the ciphertext c1', compress and encode the ciphertext polynomial v' to generate the ciphertext c2', and combine the ciphertext c1' and the ciphertext c2' into the final ciphertext c';

[0096] Step S311, verify whether the ciphertext c' is equal to the ciphertext c, if they are equal, no operation is performed, if they are not equal, key derivation (hash operation) is performed on the ciphertext c and the random number z, and the shared key K' is reassigned to the derived value K'=KDF(z,c);

[0097] Step S312: finally output the shared key K'.

[0098] Embodiment 1:

[0099] The present invention provides a Kyber encapsulation mechanism pre-computation implementation method, the method comprising:

[0100] When the unsealing key holder performs the key pair generation process, the public key polynomial matrix A is directly pre-stored, and the public key of the encapsulating key holder is pre-calculated and stored polynomial matrix A;

[0101] When the encapsulation key holder performs the encapsulation process and the decapsulation key holder performs the decapsulation process, the public key polynomial matrix A is directly read.

[0102] Compared with the existing real-time calculation implementation of Kyber packaging mechanism, the pre-calculation implementation method of Kyber packaging mechanism can greatly improve the packaging and decapsulation speed, up to about 30%. In the case of sufficient storage resources and high efficiency requirements, it effectively improves the operation efficiency of the algorithm and completes the packaging and decapsulation tasks normally.

[0103] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for implementing Kyber encapsulation mechanism pre-computation, characterized in that: The method includes: When the unsealing key holder performs the key pair generation process, the public key polynomial matrix A is directly pre-stored, and the public key of the encapsulating key holder is pre-calculated and stored polynomial matrix A; When the encapsulation key holder performs the encapsulation process and the decapsulation key holder performs the decapsulation process, the public key polynomial matrix A is directly read.

2. The Kyber encapsulation mechanism pre-computation implementation method according to claim 1, characterized in that: The key pair generation process performed by the decryption key holder includes: Step S11, generating a random number sequence d and a random number sequence z; Step S12, hashing the random number d to generate a public key random seed ρ and a noise random seed σ, (ρ, σ) = G(d); Step S13, using the public key random seed ρ to sample the public key polynomial matrix A=sam(ρ); Step S14, using the noise random seed σ to sample the private key polynomial vector s and the noise polynomial vector e, (s, e) = Sam(σ); Step S15, calculating the public key polynomial vector t=As+e; Step S16, encode the public key polynomial vector t and the public key random seed ρ to generate the encryption public key pk=encode(t,ρ), encode the private key polynomial vector s to generate the decryption private key sk=encode(s); Step S17, calculate the hash value h(pk) of the encrypted public key pk, and synthesize the decryption key dk=(sk,pk,h(pk),z); the encrypted public key pk is the encapsulation key ek, which is sent to the encapsulation key holder, the decryption key dk is stored by itself, and the public key polynomial matrix A is pre-stored at the same time.

3. The Kyber encapsulation mechanism pre-computation implementation method according to claim 2, characterized in that: The step S17 also includes: the encapsulation key holder receives the encapsulation key ek, stores the encapsulation key ek, and extracts the public key random seed ρ in the encapsulation key ek, and according to the sampling process of step S13, uses the public key random seed ρ to pre-sample the public key polynomial matrix A, and then pre-stores the public key polynomial matrix A.

4. The Kyber encapsulation mechanism pre-computation implementation method according to claim 3, characterized in that: The pre-storage method of the public key polynomial matrix A is non-volatile storage.

5. The Kyber encapsulation mechanism pre-computation implementation method according to claim 2, characterized in that: The step S13 specifically includes: S131, first absorb the public key random seed ρ; S132, then squeeze out a certain number of sample sequences B, which conform to uniform random distribution; S133, then sample a polynomial coefficient, determine whether the polynomial coefficient meets the conditions, if so, retain the polynomial coefficient, if not, reject the polynomial coefficient, determine whether there are remaining samples in the sample sequence B, if yes, resample the coefficient, if no, squeeze a new sample sequence and resample the polynomial coefficient, and repeat until a polynomial coefficient that meets the conditions is sampled; S134. Finally, determine whether there are any unsampled polynomial coefficients. If not, the sampling of the polynomial coefficients of the public key matrix is ​​completed. If so, determine whether there are remaining samples in the sample sequence B. If so, sample the next polynomial coefficient. If not, squeeze out a new sample sequence and then sample the next polynomial coefficient. Repeat this cycle until the sampling of all polynomial coefficients of the public key matrix A is completed.

6. The Kyber encapsulation mechanism pre-computation implementation method according to claim 5, characterized in that: In S131, the public key random seed ρ is absorbed by the SHAKE-128 algorithm.

7. The Kyber encapsulation mechanism pre-computation implementation method according to claim 5, characterized in that: In S132, S133, and S134, the SHAKE-128 algorithm is used to squeeze out the sample sequence.

8. The Kyber encapsulation mechanism pre-computation implementation method according to any one of claims 1 to 7, characterized in that: The encapsulation key holder performs encapsulation including the following steps: Step S21, generating a random number sequence m; Step S22, hashing the encrypted public key pk to generate a public key hash value H(pk); Step S23, hash the random number m and the public key hash value H(pk) to generate a shared key K and a random coin r, (K, r) = G(m, H(pk)); Step S24, decode the encrypted public key pk, generate the public key polynomial vector t and the public key random seed ρ, (t, ρ) = decode(pk); Step S25, reading the pre-calculated and stored public key polynomial matrix A; Step S26, using a random coin r to sample the polynomial vector r, the noise polynomial vector e1 and the noise polynomial e2, (r, e1, e2) = Sam (r); Step S27, calculate the ciphertext polynomial vector u=A T r+e1, calculate the ciphertext polynomial v=t T r+e2+μ; Step S28, compress and encode the ciphertext polynomial vector u to generate the ciphertext c1, compress and encode the ciphertext polynomial v to generate the ciphertext c2, and synthesize the ciphertext c1 and the ciphertext c2 into the final ciphertext c=(c1, c2); Step S29: Output the shared key K and send the ciphertext c to the decryption key holder.

9. The Kyber encapsulation mechanism pre-computation implementation method according to claim 8, characterized in that: The decapsulation process performed by the decapsulation key holder includes: after receiving the ciphertext c, the decapsulation key holder performs the following steps: Step S31, splitting the ciphertext c into ciphertext c1 and ciphertext c2, decoding the ciphertext c1 to generate a ciphertext polynomial vector u, decoding the ciphertext c2 to generate a ciphertext polynomial v; Step S32, decoding the decryption private key sk, generating a private key polynomial vector s=decode(sk); Step S33: Calculate the decryption polynomial w=vs T u; Step S34, compress and encode the decryption polynomial w to decrypt the random number sequence m'; Step S35, hash the random seed m' and the public key hash value h(pk) to generate a shared key K' and a random coin r'; Step S36, decoding the encrypted public key pk, generating a public key polynomial vector t and a public key random seed ρ; Step S37, reading the pre-stored public key polynomial matrix A; Step S38, using random coin r' to sample polynomial vector r', noise polynomial vector e1' and noise polynomial e2', (r', e1', e2') = Sam(r'); Step S39, calculate the ciphertext polynomial vector u'=A T r'+e1', calculate the ciphertext polynomial v'=t T r'+e2'+μ; Step S310, compress and encode the ciphertext polynomial vector u' to generate the ciphertext c1', compress and encode the ciphertext polynomial v' to generate the ciphertext c2', and synthesize the ciphertext c1' and the ciphertext c2' into the final ciphertext c'; Step S311, verify whether the ciphertext c' is equal to the ciphertext c, if they are equal, no operation is performed, if they are not equal, a key is derived from the ciphertext c and the random number z, and the shared key K' is reassigned to the derived value K'=KDF(z,c); Step S312: finally output the shared key K'.

10. The Kyber encapsulation mechanism pre-computation implementation method according to claim 9, characterized in that: In S311, the key is derived by using a hash operation.

Images